lkml.org 
[lkml]   [2018]   [Jun]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.16 182/279] bpf: use array_index_nospec in find_prog_type
    Date
    4.16-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Daniel Borkmann <daniel@iogearbox.net>

    [ Upstream commit d0f1a451e33d9ca834422622da30aa68daade56b ]

    Commit 9ef09e35e521 ("bpf: fix possible spectre-v1 in find_and_alloc_map()")
    converted find_and_alloc_map() over to use array_index_nospec() to sanitize
    map type that user space passes on map creation, and this patch does an
    analogous conversion for progs in find_prog_type() as it's also passed from
    user space when loading progs as attr->prog_type.

    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Cc: Mark Rutland <mark.rutland@arm.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/syscall.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/kernel/bpf/syscall.c
    +++ b/kernel/bpf/syscall.c
    @@ -872,11 +872,17 @@ static const struct bpf_prog_ops * const

    static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
    {
    - if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type])
    + const struct bpf_prog_ops *ops;
    +
    + if (type >= ARRAY_SIZE(bpf_prog_types))
    + return -EINVAL;
    + type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types));
    + ops = bpf_prog_types[type];
    + if (!ops)
    return -EINVAL;

    if (!bpf_prog_is_dev_bound(prog->aux))
    - prog->aux->ops = bpf_prog_types[type];
    + prog->aux->ops = ops;
    else
    prog->aux->ops = &bpf_offload_prog_ops;
    prog->type = type;

    \
     
     \ /
      Last update: 2018-06-18 11:37    [W:5.453 / U:0.312 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site